ARTIFICIAL INTELLIGENCE AND MACHINE LEARNING APPROACHES

FOR AVIATION CYBERSECURITY: AN OVERVIEW

Anna Baron Garcia, Radu F. Babiceanu, and Remzi Seker
Department of Electrical Engineering and Computer Science,
2021 Integrated Communications Navigation and Surveillance Conference (ICNS) | 978-1-6654-3584-0/20/$31.00 ©2021 IEEE | DOI: 10.1109/ICNS52807.2021.9441594

Embry-Riddle Aeronautical University, Daytona Beach, FL

Abstract Introduction
Artificial Intelligence (AI) and Machine Generally, it is understood that cybersecurity
Learning (ML) applications are currently found within the aviation ecosystem is a global threat that
across all engineering domains, including requires a global solution. The International Civil
cybersecurity engineering. This paper presents an Aviation Organization (ICAO) recommended that
overview of the AI-systems and technologies that can each Contracting State should develop measures to
greatly benefit the security domain and its potential address cybersecurity [1].
solutions for the aviation industry: anomaly detection
In the United States, the National Strategy for
for avionics, securing data link communications, and
Aviation Security published December 2018 [2],
security certification, among others.
aimed to address the enhancement of the safety and
As showcased in the “National Strategy for security of the aviation ecosystem while preserving
Aviation Security” report in December 2018 and the the freedom of operations. Its objectives were
U.S. Government Accountability Office report described as follows: (i) protect the US and Global
“Aviation Cybersecurity” in October 2020, there is a Interest in the Aviation Ecosystem, (ii) maximize
need for resilient cybersecurity practices and aviation ecosystem security while maintaining
approaches to address the current issues that aviation aviation safety and balancing US economic impact,
faces today. Designing and implementing solutions to (iii) enhance resilience, mitigate damage, and
address these issues without exploring the feasibility expediate recovery, and (iv) effectively engage
of harnessing AI-powered cybersecurity tools would international, domestic, and private sector partners.
overlook the potential advantages these technologies
Its strategic actions were clearly stated: (i)
can offer.
maximize domain awareness, (ii) anticipate threats
Therefore, this paper aims to provide a roadmap and assess vulnerability to and from the aviation
to adapt well-known ML-cybersecurity approaches to ecosystem, (iii) ensure continuity and promote
aviation security engineering and airworthiness: (i) resilience of the aviation domain, and (iv) enhance
autonomous and semi-autonomous cybersecurity for international cooperation [3].
autonomous flight operations security, (ii) game
While aviation cybersecurity research is still
theory models for adversarial and uncertainty
ongoing, studying AI/ML algorithms seem to be the
modeling, (iii) human-AI interfaces for airport
next step for cybersecurity engineering (as it has been
security monitoring and decision-making assistance,
shown for other industries). Therefore, the main goal
(iv) predictive analytics for anomaly detection for
of this paper is to address the following question:
avionics and e-enabled aircraft, and (v) AI-based
“Can aviation benefit from AI-based cybersecurity?”
reasoning trustworthiness for software reliability and
security certification. This paper also presents the
challenges of including AI-cybersecurity in the Artificial Intelligence and Machine
aviation ecosystem to ground the proposed solutions Learning for Cybersecurity
within an accepted set of industry regulations, such as
design verification for AI/ML algorithms and Artificial Intelligence (AI) and Machine
certification specifications for AI/ML solutions for Learning (M.L.) methodologies and techniques have
manufacturers and agencies. been surveyed [4] and reviewed at length [5] during
the past years. While the actual description of the
common AI/ML methodologies and techniques is out

978-1-6654-3584-0/21/$31.00 ©2021 IEEE

1
Authorized licensed use limited to: Hong Kong University of Science and Technology. Downloaded on November 05,2023 at 13:04:02 UTC from IEEE Xplore. Restrictions apply.
 of scope of this paper, a brief classification based on Autonomous Cybersecurity
the nature of the learning would be [6]: The AI/ML methodologies are used for
• Supervised learning: the system has inputs autonomous cybersecurity (which is independent
and desired outputs which are known from human interaction) and semi-autonomous
(labeled), with the purpose of mapping cybersecurity (which contains semi-independent and
them. The most common techniques are human-in-the-loop paradigms).
regression and classification, which need In this category, the AI/ML methods are used to
labeled datasets for their training and plan for the worst-case scenarios and analyze
testing. potential and actual threats. AI is also used to
• Unsupervised learning: the system finds generate attack plans and goals, as well as actions
patterns between inputs but with no that can help discover an attacker’s intention.
(apparent) desired outputs. The most • Challenges: due to the nature of the
common technique is clustering, which does automation, avoiding conflicting security
not need labeled data to extract patterns. measures should be a priority.
• Reinforced learning: the system is provided • Research: AI/ML can be used to make
feedback and a set of rules. Deep learning systems resistant to autonomous analysis or
and associative reinforced learning are autonomous attacks with no human
some of the common techniques. interaction; it can also assist in determine
the attacker’s intent. There is also a need to
A.I. and M.L. Classification for Cybersecurity translate cybersecurity mission statements
and operations into inputs for automated
AI/ML methodologies can also be classified by
cybersecurity.
which types of applications they are part of. A five-
type general description of AI/ML methodologies for
cybersecurity is presented in Figure 1.

Figure 1. Types of A.I. and M.L. for Cybersecurity Engineering

Game Theory The AI/ML methods are used to simulate and

The AI/ML methodologies are used to model show differential scenarios for cybersecurity. The
any cyber defense of cyber offense capabilities and scenario takes into account changes in environmental
scenarios. values, player incentives, and other attack
discoveries, and produces a new output accordingly.

2
Authorized licensed use limited to: Hong Kong University of Science and Technology. Downloaded on November 05,2023 at 13:04:02 UTC from IEEE Xplore. Restrictions apply.
 Some scenarios can plan for irrational players that new patterns might be discovered, which a traditional
would act in unpredictable ways. analysis might not be able to unveil. Cyber and
human domains can also be cross-reference in search
• Challenges: cooperation between several AI
for patterns that might not be apparent.
systems and teams.
• Challenges: obtaining the clean, labeled, and
• Research: AI/ML methods for additional AI
real data; or, in its absence, synthetic but
techniques for uncertainty planning, in
realistic data for training the AI/ML
cooperative, as well as noncooperative
algorithms.
environments; for assumptions in attacker
capabilities and incentives. Further research • Research: potential research in building
into the game’s action space is also needed. datasets with real data or synthetic data that
portray an accurate representation of reality.
Also, research in validation, cross-
Human-A.I. Interfaces
referencing, and identifying potential flaws
In this case, the AI/ML methods are focused on of existing datasets.
the coordination and trust between AI-cybersecurity
systems and the people that interact with them.
Trustworthiness
These AI/ML methodologies are used to
The AI/ML methodologies are employed to
determine the best way to team with human resources
allow systems to become more trustworthy with AI-
to maximize the positive outcomes of the system and
based reasoning when the right cybersecurity policies
minimize the negative consequences. The AI system
are used.
objectives need to be honored by all individual
system components, so that they do not maximize The AI/ML methods are used to securely
their own goals at the expense of the system’s. develop, deploy, and operate software systems. It can
detect low-level attack vectors of logic errors that
• Challenges: Hybrid good decision making
traditional analysis might not. AI systems can also
for human and AI. Information can be categorize several attacks and produce adaptive
manipulated to the point that a person could responses when inconsistencies are found across the
trust an AI-generated video/voice recording. systems. AI-based tools can be used as access control
Decision-making assistance from AI and tools based on expected behavior instead of a token.
predictive models are needed when humans
• Challenges: ethical and privacy violations
are not able to make the correct decisions
arise when there is monitoring of behavioral
effectively.
patterns for identity management.
• Research: The research should be focused on • Research: the AI/ML research is focused on
human-machine teaming, AI-decision software development and the
making assistance, and AI models that can trustworthiness of the AI system itself.
predict human erroneous decisions.

Aviation Cybersecurity
Predictive Analytics
Aviation cybersecurity requires an in-depth
The most common type of AI/ML methods and knowledge of the aviation ecosystem, as well as
techniques are predictive analytics, which take industry-specific policies, specifications, and
advantage of a priori knowledge, i.e., classified regulations. As a general description, one could
sources. They process information to assess the classify aviation cybersecurity in four distinctive
likelihood of an attack and discover patterns, links, branches when addressing the aircraft as focus:
and anomalies of different datasets from
human/systems domains. • Aircraft as a System of Systems: the
aircraft is understood as a system-of-systems
In these AI/ML methods the information from
box. Common security issues include:
internal and external sources can be cross-referenced:

3
Authorized licensed use limited to: Hong Kong University of Science and Technology. Downloaded on November 05,2023 at 13:04:02 UTC from IEEE Xplore. Restrictions apply.
 avionics security [7], internal networking aviation-related and aerospace areas that already
security [8], COTS on board, etc. benefit from AI [14-18]:
• Aircraft as a Node of a Network: the • Airline Performance: fuel usage
aircraft is considered as one node of a large optimization; improving routes.
network of other aircraft and ground stations • Automation and Autonomy: speech
and satellites [9] [10] (e.g., aircraft mobility recognition models for controller assistance.
and security paradigms, ATN/IPS security). • Capabilities: environmental improvements;
• Aircraft interaction within its automatic speech recognition; automatic
Environment: the aircraft is observed as a taxi, take-off, and landing enabled by
box that interacts with its environment using computer vision.
communications techniques. Its main • Passengers: biometrics for boarding.
security issues are studied in communication • Resource management and optimization:
protocols such as ADS-B, ADS-C, CPDLC,
ATM support/capacity balancing;
ACARS, and AeroMACS.
optimization of capacity with current
• Policies regarding the Aviation Ecosystem: resources [19].
the regulations, standards, best practices • Traffic prediction and forecast modeling:
[11], and security specifications that improving predictions.
determine the aircraft design and operation
and its aviation ecosystem. Therefore, it is not difficult to imagine that
aviation cybersecurity could benefit from AI/ML as
well. Considering the initial classification of the
A.I. and M.L. Approaches in Aviation AI/ML methodologies depending on application and
Cybersecurity the current branches of aviation cybersecurity, an
There have been AI/ML reported advances in adapted classification for AI/ML for aviation
the aviation industry that are not related to cybersecurity is presented in Figure 2.
cybersecurity [12] [13]. There are several other

Figure 2. Adapted Types of A.I. and M.L. for Aviation Cybersecurity

Autonomous Cybersecurity and regular flight operational security. They can

Autonomous cybersecurity AI/ML classify diverse types of events in Security Operations
methodologies can be used for autonomous flight Center (SOC) anywhere in the aviation ecosystem [20],
as well as provide autonomous decision aid for flight

4
Authorized licensed use limited to: Hong Kong University of Science and Technology. Downloaded on November 05,2023 at 13:04:02 UTC from IEEE Xplore. Restrictions apply.
 operations [21]. They also help identify pattern vectors with hardware and software for safety-critical
conception that can later be used in predictive systems.
analysis; and offer support in risk analysis
methodologies.
A.I. and M.L. Challenges
As mentioned in Section II, AI/ML methodologies
Game Theory for cybersecurity do have some challenges to be fully
Game Theory AI/ML methodologies address useful. In a 2018 comparative study of AI/ML
adversarial and uncertainty modeling. They can techniques for aviation [6], the main challenge
improve the simulator capabilities for flight, as well highlighted is the unavailability of high-quality data
as create more realistic threat scenarios for cyber due to the fact that most data are considered private or
defense/offense table-top exercises. belongs to an industrial organization. This leads to a
slow process of research and implementation of AI/ML
Human-AI Interfaces models since the models themselves cannot be
train/tested on real data. In addition, in [31] the
The Human-AI interfaces AI/ML methods can Artificial Neural Networks (ANN) developed during
be employed in airport security monitoring and the research stage could be assumed to work on an
provide decision-making assistance for human-in- aviation application, but a challenge presented itself
the-loop systems. These AI/ML methods allow for: when one wanted to efficiently integrate a traditional
(i) adapting risk mitigation and security controls to airborne computer with a system with ANN, due to the
needs of aviation domain [22], (ii) auto generation lack of system verification.
of attack trees for critical infrastructure and aviation
systems of systems [23] [24], (iii) linking weak
signals and modeling suspicious interactions inside Challenges
networked systems or Air Traffic Operations The following challenges need to be addressed to
systems data flows, (iv) automation for non-safety be able to fully develop AI/ML methodologies and
systems. frameworks for aviation cybersecurity.
Challenge #1: The Lack of Testbeds
Predictive Analytics Building testbeds for aviation applications is a
Predictive Analytics are the most commonly costly endeavor that cannot always be afforded by
studied AI/ML methods in aviation cybersecurity. research groups or small companies. The aviation
They allow for anomaly detection for the aviation ecosystem and its data, at the technical level, is highly
ecosystem and faulty system component detection regulated and follows specifications that cannot be
in scenarios such as: (i) avoiding missing relevant accessed by all. The testbeds have to generate accurate
information/cross-reference information [25], (ii) and labeled data that can be useful for AI/ML research.
cyber monitoring and detection in aviation [26], (iii) Challenge #2: No Readily Available Datasets
intrusion detection [27], (iv) predicting cyberattacks Since not everyone can build a testbed, readily
and risk [28], (v) anomaly detection through available datasets would be useful to bring more
component behavior [29] [30], (vi) isolate the attack research into the aviation cybersecurity focus.
and minimize its impacts. Unfortunately, this is not currently the case, as the
Trustworthiness datasets that could be used for aviation cybersecurity
Trustworthiness AI/ML methods in aviation are scarce and do not cover all aviation cybersecurity
cybersecurity can be used for software reliability domains.
and its deployment, as well as fingerprinting Challenge #3: Policies, politics, and regulations
applications, and security certification. These Aviation cybersecurity policies and regulations
methods can allow for: (i) safety-critical software are not always quick and straightforward processes,
development with AI testing/verification to identify and they are usually bound by politics from
low-level attack vectors, (ii) cross-reference attack Contracting States (ICAO). There is a need for a civil
aviation cybersecurity architecture [32] that can

5
Authorized licensed use limited to: Hong Kong University of Science and Technology. Downloaded on November 05,2023 at 13:04:02 UTC from IEEE Xplore. Restrictions apply.
 address legislation and standards in a timely o End State: One or more testbeds are
manner; and that can also regulate any upcoming used to gather and modify different
AI/ML methodology that benefits aviation types of aviation data (correctly
cybersecurity. labeled) and to test different use cases
of data.
Roadmap for A.I. and M.L. • Goal 2: Develop methodologies for aviation
More research is needed to shift the AI/ML AI/ML algorithm robustness.
methods from a laboratory setting to a production o End State: Methodologies for one or
environment. The E.U.A.S Agency [33] proposes several of aviation AI applications are
an Artificial Intelligence Roadmap that follows a studied and implemented.
human-centric approach to develop AI/ML
methodologies. While human-in-the-loop is a • Goal 3: Build framework(s) for complex
branch of cybersecurity engineering that benefits dataset AI/ML for training and testing.
greatly from AI/ML methods, this paper proposes a o End State: One or more frameworks
general Roadmap that can be applied to any of the are designed and used to train/test
previously described types of AI/ML Aviation different AI methods.
Cybersecurity in Figure 2.
• Goal 4: Develop new AI-based techniques for
The Roadmap (Figure 3) is divided into four aviation cybersecurity.
smaller goals that are to be accomplished
sequentially to ensure that all challenges are o End State: New AI-based techniques
addressed and a robust AI/ML aviation security are designed and implemented to
system is built: address current and upcoming
aviation cybersecurity challenges.
• Goal 1: Build testbed(s) for data gathering,
dataset acquisition, and testing.

Figure 3. Roadmap for A.I. and M.L. for Cybersecurity in the Aviation Ecosystem

Conclusions and Future Research affirmative, albeit it should consider the challenges
outlined in this paper.
Having reviewed the AI/ML and Aviation
Cybersecurity current states, it can be concluded that The state-of-the-art of AI/ML for cybersecurity
the answer to the initial question “Can aviation is more advanced than the current state of AI/ML for
cybersecurity benefit from AI/ML techniques?” is aviation and combining both would require a joined
effort from all states in ICAO. This, in turn, requires

6
Authorized licensed use limited to: Hong Kong University of Science and Technology. Downloaded on November 05,2023 at 13:04:02 UTC from IEEE Xplore. Restrictions apply.
 an investment in research and developing new https://www.sciencedirect.com/science/article/pii/S15
regulations, standards, and best practices for the 74013720304172
AI/ML methodologies. Any research conducted
[6] A. Maheshwari, N. Davendralingam, and D.
should include: (i) a testbed and datasets with real
DeLaurentis, “A Comparative Study of Machine
and accurate data that reflects real-life situations, (ii)
Learning Techniques for Aviation Applications,” 06
the creation and maintenance of realistic simulation
2018.
environments, (iii) the development of avionics-
specific datasets that are modular and can be shared [7] L. Wang, T. Cheng, and Y. Li, “Preliminary
to foster innovation and collaboration. Research of Secure Integrated Computing in Future
Avionics,” in 2016 12th International Conference on
New regulatory actions should be developed to
Computational Intelligence and Security (CIS), 2016,
include the standards, best practices, and policies.
pp. 685–688.
The addition of AI/ML methodologies in the aviation
ecosystem would affect future aircraft design, [8] K. Kainrath, M. Fruhmann, K. Gebeshuber, E.
operations, maintenance, and any ATM operations, Leitgeb, and M. Gruber, “Evaluation of Cyber
which would include different specifications than the Security in Digital Avionic Systems,” 05 2020, pp.
ones that are currently in place. Additional Means of 1–5.
Compliance should be developed in the long run as [9] D. Housen-Couriel, “Cybersecurity threats to
well. satellite communications: Towards a Typology of
In conclusion, AI/ML methodologies and State Actor Responses,” Acta Astronautica, vol. 128,
techniques can be used to increase aviation security, 07 2016.
offering aid in decision making scenarios, finding [10] J. M. Mercado and D. C. Rowe, “Cyber-security,
patterns to determine risk, and detecting faulty Aerospace, and Secure Satellite Communications -
components in the systems; however, there are still evolving our approach,” New Orleans, Tech. Rep.,
some steps ahead to make it fully operational. 2016.
[11] P. Cooper, S. Handler, and S. Shahwan,
References “Aviation Cybersecurity: Scoping the Challenge,”
[1] R. Abeyratne, “Cyber Terrorism and Aviation— Washington, DC, Tech. Rep., 2019.
National and International Responses,” Journal of [12] E. A. . A. A. H. L. Group, “The FLY AI Report
Transportation Security, vol. 4, pp. 337–349, 12
2020: Demystifying and Accelerating AI in
2011. Aviation/ATM,” Tech. Rep., 2020.
[2] T. W. House, “National Strategy for Aviation [13] S.-H. Chung, H.-L. Ma, T.-M. Choi, and M.
security of the United States of America,”
Hansen, “Data Science and Analytics in Aviation,”
Washington, DC, Tech. Rep., 2018. Transportation Research Part E Logistics and
[3] C. Security and I. A. I. W. G. S. on Networking & Transportation Review, vol. 134, 01 2020.
Information Technology Research & Development
[14] D. Lary, Artificial Intelligence in Aerospace, 01
Committee on Science & Technology Enterprise of 2010.
the National Science & Technology Council,
“Federal Cybersecurity research and Development [15] T. Shmelova, Handbook of Research on
Strategic Plan,” Tech. Rep., 2019. Artificial Intelligence Applications in the Aviation
and Aerospace Industries, 11 2019, ch. 1. Artificial
[4] S. Mahdavifar and A. Ghorbani, “Application of Intelligence in Aviation Industries: Methodologies,
Deep Learning to Cybersecurity: A survey,”
Education, Applications, and Opportunities.
Neurocomputing, vol. 347, 03 2019.
[16] S. Brunton, J. Kutz, K. Manohar, A. Aravkin, K.
[5] P. Dixit and S. Silakari, “Deep Learning Morgansen, J. Klemisch, N. Goebel, J. Buttrick, J.
Algorithms for Cybersecurity Applications: a
Poskin, A. Blom-Schieber, T. Hogan, and D.
Technological and Status Review,” Computer McDonald, “Data-Driven Aerospace Engineering:
Science Review, vol. 39, p. 100317, 2021. [Online].
Available:

7
Authorized licensed use limited to: Hong Kong University of Science and Technology. Downloaded on November 05,2023 at 13:04:02 UTC from IEEE Xplore. Restrictions apply.
 Reframing the industry with Machine Learning,” 08 [25] M. Schwabacher and K. Goebel, “A survey of
2020. Artificial Intelligence for Prognostics,” AAAI Fall
Symposium - Technical Report, 01 2007.
[17] J.-G. Meß, F. Dannemann, and F. Greif,
“Techniques of Artificial Intelligence for Space [26] T. Shmelova, Handbook of Research on
Applications - A Survey,” 02 2019. Artificial Intelligence Applications in the Aviation
and Aerospace Industries, 11 2019, ch. 7.
[18] A. Mcgovern and K. Wagstaff, “Machine
Applications of Artificial Intelligence in Flight
Learning in space: Extending our reach,” Machine
Management Systems.
Learning, vol. 84, pp. 335–340, 09 2011
[27] X. Ying, J. Mazer, G. Bernieri, M. Conti, L.
[19] D. Truong, “Using Causal Machine Learning for
Bushnell, and R. Poovendran, “Detecting ADS-B
Predicting the Risk of Flight Delays in Air
Spoofing attacks using Deep Neural Networks,” 06
Transportation,” Journal of Air Transport
2019, pp. 187–195.
Management, vol. 91, p. 101993, 2021. [Online].
Available: [28] X. Zhang and S. Mahadevan, “Ensemble
https://www.sciencedirect.com/science/article/pii/S09 Machine Learning Models for Aviation Incident Risk
69699720305755 Prediction,” Decision Support Systems, vol. 116, pp.
48–63, 01 2019.
[20] T. Shmelova, Handbook of Research on
Artificial Intelligence Applications in the Aviation [29] M. Gatti and A. Damien, “AI, Connectivity and
and Aerospace Industries, 11 2019, ch. 2. Rational Cyber-Security in Avionics,” 09 2019, pp. 35–38.
Adaptation of Control Systems for the Autonomous
[30] T. Shmelova, Handbook of Research on
Aircraft Motion.
Artificial Intelligence Applications in the Aviation
[21] ——, Handbook of Research on Artificial and Aerospace Industries, 11 2019, ch. 17. Basic
Intelligence Applications in the Aviation and Analytics of Anti-Failure Avionics.
Aerospace Industries, 11 2019, ch. 3. Intelligent
[31] T. Cheng, P. Wen, and Y. Li, “Research status
Automated System for Supporting the Collaborative
of Artificial Neural Network and its Application
Decision Making by Operators of the Air Navigation
Assumption in Aviation,” 12 2016, pp. 407–410.
System During Flight Emergencies.
[32] S. J. Fox, “Flying Challenges for the Future:
[22] K. Hon, C. Ng, and P. Chan, “Machine Learning
Aviation Preparedness – in the Face of Cyber-
Based Multi-Index Prediction of Aviation Turbulence
Terrorism,” Journal of Transportation Security, vol.
Over the Asia-Pacific,” 11 2020.
9, 12 2016.
[23] T. Puranik, N. Rodriguez, and D. Mavris,
[33] E. U. A. S. Agency, “Artificial Intelligence
“Towards Online Prediction of Safety-Critical
Roadmap: A Human-Centric Approach to AI in
Landing Metrics in Aviation using Supervised
Aviation,” Tech. Rep., 2020.
Machine Learning,” Transportation Research Part C
Emerging Technologies, vol. 120, p. 102819, 10
2020.
[24] T. Shmelova, Handbook of Research on 2021 Integrated Communications Navigation
Artificial Intelligence Applications in the Aviation and Surveillance (ICNS) Conference
and Aerospace Industries, 11 2019, ch. 16. Methods April 20-22, 2021
for Assessing the Glissade Entrance Quality by the
Crew.

8
Authorized licensed use limited to: Hong Kong University of Science and Technology. Downloaded on November 05,2023 at 13:04:02 UTC from IEEE Xplore. Restrictions apply.